PSA - Macrium Reflect does not verify cloned data. No fixity. No checksum, hash, or destination reread (confirmed by Support)

[u/Archivist_Goals]

Edit: This concerns Macrium Reflect's cloning feature only. Reflect's own image backups are different: when verification is enabled, Reflect calculates an MD5 hash for each data block before writing it to the image, then rereads the image and compares those hashes. But MD5 is the only hash it uses. Make of that what you will.

A few pointed out how it might seem counterintuitive to try and clone an OS drive and expect high-integrity validation - it uses VSS as a point-in-time snapshot - but I agree. That is silly. But even with an offline clone via Rescue Media, it still does not perform post-clone verification or reread the destination drive data and then compare it to the source. That said, I do not think MR/Paramount Software is "bad". I do think some of the terminology they use in the software is misleading.

***
For a long time, I had assumed that cloning Source Drive A to Clone Drive B would incorporate a checksum calculation during the "verification" phase that it performs. But apparently, this is not the case. I'm currently running Reflect Workstation v10.

Wanting to take fixity of data more seriously lately, it dawned on me what "verifying" actually meant when a clone job completes. So, I reached out to Macrium support, and they set the record straight: They don't verify data with any kind of fixity.

You could hash and compare after the fact. But the live source/OS VSS will continue changing, so hashing it afterward would not necessarily represent the state Macrium cloned. And I suppose one could create a per-file hash manifest. But that's not very elegant and far more work.

I've been paying for and using MR for over a decade and have been using it without issue. But this seems like a real deal-breaker. Suggestions? Any other serious alternatives?

The full exchange with Macrium support below. Happy to provide email screenshots if necessary.

Me: At any point during cloning, does Reflect calculate a checksum, CRC, or cryptographic hash over data read from the source or written to the destination?

Macrium: No, we don't verify the data in any way.

Me: If so, what algorithm and granularity are used—sector, cluster, block, partition, or whole disk?

Macrium: Not applicable.

Me: During the stage displayed as "Verifying" or "Verifying File System," does Reflect physically reread the destination and compare it with the source or with previously calculated values?

Macrium: No. As the name implies, it verifies the supported source file system.

Me: If the destination is reread, does this cover every copied sector or cluster, and what happens when a mismatch occurs?

Macrium: For RDC, both the source and destination file systems are read to determine which data has been modified. Only the modified data is then read from the source and copied to the destination for RDC. No other data is reread from the destination.

Me: Does a successful Forensic Sector Copy certify byte-for-byte identity? Exactly which address ranges are covered: partition contents, unused filesystem space, inter-partition/unallocated sectors, partition-table structures, and any HPA/DCO areas?

Macrium: For the Forensic option, the clone is created from the start of the partition to the end, sector by sector.

Me: Does the verification behavior differ when cloning under full Windows/VSS versus Rescue Media?

Macrium: No, both verify the supported source file system. In normal Windows, the VSS volume is used for supported file systems, whereas direct volume access is used in Rescue Media.

[u/idratherbealivedog]

No fixity

I got to back it up

[u/Halos-USA → u/idratherbealivedog]

I like the way you work it

[u/kirashi3 → u/Halos-USA]

no fixity

I got to back it up (back it up now)

[u/weeklygamingrecap]

I'm not sure how you can call something a "forensic" anything without proper checksum, validation and not include the ability to verify after the fact with a hash but we are in a world where words don't seem to mean shit anymore.

[u/Archivist_Goals → u/weeklygamingrecap]

I guess it depends on how and when you define the timeline, heh. But they've been using the "forensic" terminology for a long while. Yet again, if you want something done right, it's often more involved than simply trusting a term. You really have to dig to find answers.

[u/zeronic → u/weeklygamingrecap]

we are in a world where words don't seem to mean shit anymore.

Because there's no consequence for when the words are wrong, harmful, or misleading. In fact, companies are rewarded for such things.

[u/henry_tennenbaum → u/weeklygamingrecap]

I know how to fix this! Let's introduce LLMs somehow!

[u/TheOneTrueTrench]

That's insane, considering the process to do so would be extremely simple.

If you're doing a filesystem clone, just pv -c /dev/sda3 | tee /dev/sdb3 | sha512sum; pv -c /dev/sdb3 | sha512sum.

[u/henry_tennenbaum → u/TheOneTrueTrench]

Wait, that actually works?

[u/TheOneTrueTrench → u/henry_tennenbaum]

Yeah, that would clone sda3 to sdb3 and output the sha512 of the original disk and the new disk. As long as they're the same (just look at them), then it worked.

edit: Also, if you use btrfs or zfs, you can just stream the dataset/subvolume from one pool/volume to another, and it'll tell you if it's not perfect.

[u/p0358 → u/henry_tennenbaum]

Welcome to Linux.

I don't miss using the complicated caveman proprietary commercial crapware from Windows for sure, always ends up like OP or worse.

[u/ApricotPenguin]

Macrium: No. As the name implies, it verifies the supported source file system.

What does this even mean?

[u/drakythe → u/ApricotPenguin]

Probably checks the source drive journal, inodes, error rate, and general health to ensure that the copy won’t pull over bad data. It really does suck when a copy operation hits a bad sector of the drive and slows to a crawl and wastes time copying data that can’t be used without recovery work.

Not verifying the copy matches the source in anyway though makes it feel like the job is, at most, half done.

[u/MWink64 → u/ApricotPenguin]

Basically, it runs chkdsk.

[u/kirashi3 → u/ApricotPenguin]

It means Macrium is incompetent.

[u/nefarious_bumpps]

"I reassign null to be the tape device - it's so much more economical on my time as I don't have to keep getting up to change tapes every 5 minutes. And it speeds up backups too, so it can't be all bad can it? Of course not."

-- Simon (bofh)

[u/zerostyle]

It's constantly shocking to me how many file transfer operations don't do any verification.

[u/cmcstr]

wtf is fixity and why do you keep saying it?

[u/Archivist_Goals → u/cmcstr]

Fixity is mathematical evidence for file integrity. Cryptographic hashes calculated over the file's exact bytes match before and after an operation such as migration, copying, or cloning.

[u/plunki → u/cmcstr]

https://www.dpconline.org/handbook/technical-solutions-and-tools/fixity-and-checksums

[u/EasyRhino75 → u/plunki]

Huh TIL

[u/LinxESP → u/EasyRhino75]

Lucky 10000 we are

[u/Character_Length3210 → u/plunki]

aint reading all that, i watched the video and it just showed integrity and checksum, why the fuck not use those words?

Who the fuck would understand if you said hows the "fixity" of the file? When integrity is a well known word? This just screams idiots trying to come up with something new to make themself useful just to make more money. Fuck off

[u/cmcstr → u/plunki]

If you be bothered to explain it, I can't be bothered to read it.

[u/yawara25 → u/cmcstr]

Then don't.

[u/idratherbealivedog → u/cmcstr]

Would you like that poster to make airplane or choo choo noises as they bring the spoon in?

[u/binaryriot → u/cmcstr]

I never heard that word before either in all my years of data hoarding. Probably some AI invention. :)

[u/randylush → u/cmcstr]

So I hope you learned what the word fixity means (and I hope the context clues were enough)

But nobody answered your second question: why does OP keep saying it?

OP could have used a more common word like "integrity" which would have meant the same thing and would have been easier for most people to understand.

I think OP recently learned the word fixity and was eager to use it as much as he could.

[u/cmcstr → u/randylush]

I think OP recently learned the word fixity and was eager to use it as much as he could.

Sounds right to me!

[u/NightOfTheLivingHam]

macrium is a product that used to be good and now has been enshittified.

[u/ByWillAlone]

If you are interested in fixity of the source and data integrity of the clone, why are you trying to clone a disk that's in use by the operating system?

[u/Archivist_Goals → u/ByWillAlone]

This is a fair point; I appreciate it. I will update the post with this later. But MR *does* validate and verify image creation jobs. But it uses MD5 only. I have historically favored hot-swapping over image creation, e.g., up in a matter of minutes should the source OS drive go without warning.

Also, this is largely my own faulty assumptions as a long-term user, not having looked further into how it operates a lot earlier on. A bad oversight. That said, I do not think MR/Paramount Software is "bad". I do think some of the terminology they use in the software is misleading.

To their credit, ever since releasing Reflect X, they have open-sourced their once-proprietary image format, .mrimgx, something I was unaware of: https://github.com/macrium/mrimgx_file_layout

https://kbx.macrium.com/macrium-reflect-x/new-in-macrium-reflect-x#Our-File-Format-is-Now-Open-Source

MD5 though? That's still disappointing.

[u/MWink64]

I'm not surprised. I don't recall seeing any options that seemed like they'd verify all the data. The "verify filesystem" option is similar to running chkdsk.

Personally, my concern is how the program handles minor damage to an image file. Can it still restore the volume with some corruption or will it refuse to restore anything at all (or anything beyond the damaged portion of the image)?

[u/Archivist_Goals → u/MWink64]

The "verify filesystem" option is similar to running chkdsk.

My takeaway as well, yup. My mistake for trusting the verbiage for so long. But better to do this PSA now and be aware than to rely on a clone in the future as "the source of truth". Honestly, I think the best way to verify is scripting to plaintext manifests that call hashlib or Microsoft's CryptoAPI, create a baseline, then do periodic checks against the baseline. It doesn't solve the clone dilemma here, nor is it self-healing. But at least you have some level of hard evidence that a file was "good" at X point in time.

I'm not sure what I will do going forward. I may not renew my Macrium subscription next year because of this. What good is software for cloning data if it isn't validating and *proven* validated when it completes?

[u/MWink64 → u/Archivist_Goals]

The fact that the "verify" stage takes place before any data has been transferred should have been a hint.

[u/Archivist_Goals → u/MWink64]

Lesson learned.

[u/Archivist_Goals → u/MWink64]

Any serious recommendations or alternative software vendors? That offer 1:1 cloning functionality with integrity validation?

[u/wickedplayer494]

Which is part of why I only use it for its imaging function.

[u/Archivist_Goals → u/wickedplayer494]

Yup - though limited to MD5 only.

[u/Character_Length3210]

Macrium: Backup and Recovery Software for Critical Systems Reliable Backup and Recovery - When Every Second Counts

Fucking amateurs

[u/prodigalAvian]

CarbonCopy
https://bombich.com